Unclear documentation about permissions handling

[apperside]

Hi,
I am going through the documentation about how to use query based sync permission (https://docs.realm.io/sync/using-synced-realms/access-control/fine-grained-permissions), and I think there are some unclear points:

this is for example a code snippet in that page

// List all roles
let roles = realm.objects(Realm.Permissions.Role);

// You can query roles in order to find a specific one
let role = realm
  .objects(Realm.Permissions.Role)
  .filtered(`name = 'my-role'`)[0];
  
// Making changes to a Role requires a write transaction
let user = getUser();
realm.write(() => {
  role.members.push(user);
})

// So does creating a new role
realm.write(() => {
  realm.create(Realm.Permissions.Role, { name: "my-new-role" });
});

it assumes that after querying the roles, we have all the data; but since it is a query based sync realm, shoulnd't we get the data by using subscriptions? In that way there is no guarantee that we have all the data.

Goals

Understand how to use permissions on query based sync realms

Actual Results

I do not understand very well how them works.